Security-Sensitive Path Instrumenter
Add structured logging instrumentation to security-critical code paths for runtime monitoring of authentication, authorization, input validation, session management, and other security-relevant events.
Workflow
Identify security-sensitive code paths - Locate authentication, authorization, input validation, or session management code that needs instrumentation
Determine event types - Classify the security events to monitor (see security_events.md for taxonomy)
Review best practices - Check best_practices.md for what to log and what to avoid (never log passwords, secrets, or sensitive PII)
Select language patterns - Use language_patterns.md for language-specific instrumentation code (Python, JavaScript/TypeScript, Java)
Add instrumentation - Insert structured logging calls at key decision points:
- Before and after authentication attempts
- At authorization check points
- When validation fails
- During session lifecycle events
Include context - Log relevant data points:
- User identifier
- Timestamp (automatically added)
- IP address
- Resource accessed
- Success/failure status
- Failure reasons
Verify instrumentation - Ensure:
- No sensitive data (passwords, tokens, secrets) is logged
- Structured format (JSON) is used for machine parsing
- Appropriate log levels are set
- Performance impact is minimal
Quick Reference
Event Categories
- Authentication: Login attempts, logout, password changes, MFA, token validation
- Authorization: Access control decisions, permission checks, RBAC evaluations
- Input Validation: Validation failures, injection detection, format violations
- Session Management: Session creation/expiration, IP changes, hijacking detection
- Sensitive Data Access: PII access, financial data, encryption key usage
- Configuration Changes: Permission changes, role assignments, security policy updates
Common Patterns
Authentication (Python/Flask):
log_security_event(
event_type='authentication_attempt',
username=username,
ip_address=request.remote_addr
)
Authorization (JavaScript/Express):
logSecurityEvent('authorization_check', {
user_id: user.id,
resource: resourceId,
permission: requiredPermission,
decision: hasPermission ? 'granted' : 'denied'
});
Validation (Java/Spring):
Map<String, Object> data = new HashMap<>();
data.put("user_id", user.getId());
data.put("errors", validationErrors);
SecurityLogger.logSecurityEvent("validation_failure", data);
Helper Script
Use scripts/generate_instrumentation.py to generate code snippets:
# Generate Python authentication instrumentation
python scripts/generate_instrumentation.py python authentication
# Generate JavaScript authorization instrumentation
python scripts/generate_instrumentation.py javascript authorization
# Generate Java validation instrumentation
python scripts/generate_instrumentation.py java validation
Important Reminders
Never log:
- Passwords (plaintext or hashed)
- API keys or secrets
- Full session tokens
- Credit card numbers
- Social Security numbers
- Encryption keys
Always log:
- Event type and timestamp
- User identifier (when available)
- Success/failure status
- IP address (consider GDPR)
- Resource accessed
- Action performed
Use structured logging (JSON format) for machine parsing and analysis.
1---2name: security-sensitive-path-instrumenter3description: Instruments authentication, authorization, and input-handling code paths to monitor security-relevant events and states at runtime. Use this skill when developers need to add security monitoring and logging to their code, including tracking authentication attempts (login/logout), authorization decisions (access control checks), input validation failures, session management events, and other security-critical operations. Supports Python, JavaScript/TypeScript, and Java with structured logging patterns. Triggers when users ask to add security instrumentation, monitor security events, log authentication/authorization, track security-sensitive operations, or add security observability to their codebase.4---56# Security-Sensitive Path Instrumenter78Add structured logging instrumentation to security-critical code paths for runtime monitoring of authentication, authorization, input validation, session management, and other security-relevant events.910## Workflow11121. **Identify security-sensitive code paths** - Locate authentication, authorization, input validation, or session management code that needs instrumentation13142. **Determine event types** - Classify the security events to monitor (see [security_events.md](references/security_events.md) for taxonomy)15163. **Review best practices** - Check [best_practices.md](references/best_practices.md) for what to log and what to avoid (never log passwords, secrets, or sensitive PII)17184. **Select language patterns** - Use [language_patterns.md](references/language_patterns.md) for language-specific instrumentation code (Python, JavaScript/TypeScript, Java)19205. **Add instrumentation** - Insert structured logging calls at key decision points:21 - Before and after authentication attempts22 - At authorization check points23 - When validation fails24 - During session lifecycle events25266. **Include context** - Log relevant data points:27 - User identifier28 - Timestamp (automatically added)29 - IP address30 - Resource accessed31 - Success/failure status32 - Failure reasons33347. **Verify instrumentation** - Ensure:35 - No sensitive data (passwords, tokens, secrets) is logged36 - Structured format (JSON) is used for machine parsing37 - Appropriate log levels are set38 - Performance impact is minimal3940## Quick Reference4142### Event Categories4344- **Authentication**: Login attempts, logout, password changes, MFA, token validation45- **Authorization**: Access control decisions, permission checks, RBAC evaluations46- **Input Validation**: Validation failures, injection detection, format violations47- **Session Management**: Session creation/expiration, IP changes, hijacking detection48- **Sensitive Data Access**: PII access, financial data, encryption key usage49- **Configuration Changes**: Permission changes, role assignments, security policy updates5051### Common Patterns5253**Authentication (Python/Flask)**:54```python55log_security_event(56 event_type='authentication_attempt',57 username=username,58 ip_address=request.remote_addr59)60```6162**Authorization (JavaScript/Express)**:63```typescript64logSecurityEvent('authorization_check', {65 user_id: user.id,66 resource: resourceId,67 permission: requiredPermission,68 decision: hasPermission ? 'granted' : 'denied'69});70```7172**Validation (Java/Spring)**:73```java74Map<String, Object> data = new HashMap<>();75data.put("user_id", user.getId());76data.put("errors", validationErrors);77SecurityLogger.logSecurityEvent("validation_failure", data);78```7980## Helper Script8182Use `scripts/generate_instrumentation.py` to generate code snippets:8384```bash85# Generate Python authentication instrumentation86python scripts/generate_instrumentation.py python authentication8788# Generate JavaScript authorization instrumentation89python scripts/generate_instrumentation.py javascript authorization9091# Generate Java validation instrumentation92python scripts/generate_instrumentation.py java validation93```9495## Important Reminders9697**Never log**:98- Passwords (plaintext or hashed)99- API keys or secrets100- Full session tokens101- Credit card numbers102- Social Security numbers103- Encryption keys104105**Always log**:106- Event type and timestamp107- User identifier (when available)108- Success/failure status109- IP address (consider GDPR)110- Resource accessed111- Action performed112113**Use structured logging** (JSON format) for machine parsing and analysis.
tools-only